{"id":"CVE-2026-96365","kind":"vulnerability","aliases":["CVE-2026-96365"],"related":[],"title":"Drupal Webform: excessive resource allocation lets requests exhaust server memory","description":"Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.","summary":"Drupal Webform module versions up to 6.2.12 and 6.3.0 through 6.3.1 allocate resources without limits or throttling. An attacker can trigger excessive allocation, which can degrade or take down the site.","severity":"high","cvss":7.5,"epss":0.0046,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted","webform"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or `composer show drupal/webform`\n- Confirm whether the installed version falls in the affected ranges listed in the sources","fix":"- Upgrade the Drupal Webform module to a version newer than `6.2.12` on the 6.2 line, or to `6.3.2` or later on the 6.3 line (unknown if the sources name an exact fixed version)","status":"open","published_at":"2026-10-22T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:16:14+00:00","updated_at":"2026-10-25T03:16:14+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:16:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal Webform module to a version newer than `6.2.12` on the 6.2 line, or to `6.3.2` or later on the 6.3 line (unknown if the sources name an exact fixed version)","reach":"internet","title":"Drupal Webform: excessive resource allocation lets requests exhaust server memory","impact":"medium","summary":"Drupal Webform module versions up to 6.2.12 and 6.3.0 through 6.3.1 allocate resources without limits or throttling. An attacker can trigger excessive allocation, which can degrade or take down the site.","category":"package","nicknames":[],"who_cares":["drupal","webform","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Excessive memory or resource allocation causes denial of service on the site","analyst_note":"Confirm the fixed version and the triggering request path at https://nvd.nist.gov/vuln/detail/CVE-2026-96365 and the Drupal security advisory it links to.","how_to_check":"- Check the installed Webform version with `drush pm:list --filter=webform` or `composer show drupal/webform`\n- Confirm whether the installed version falls in the affected ranges listed in the sources","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running the Drupal Webform module in the affected version ranges are exposed. The sources do not say which Webform feature or request path triggers the excessive allocation, so the exact exposure surface is unknown. Sites without the Webform module, or running a version outside those ranges, can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":3345,"output_tokens":590,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-96365':13A,16A '0.0.0':74C '6.2.12':29B,76C '6.3.0':31B,78C '6.3.1':33B,80C 'affect':70C 'alloc':5A,34B,45B,54C,67C 'allow':65C 'attack':41B 'cve':11A,14A 'degrad':48B 'drupal':1A,17B,23B,63C 'excess':3A,44B,66C 'exhaust':8A 'host':21B 'issu':69C 'let':6A 'limit':37B,58C 'memori':10A 'modul':25B 'packag':18B 'request':7A 'resourc':4A,35B,56C 'self':20B 'self-host':19B 'server':9A 'site':53B 'take':50B 'throttl':39B,60C 'trigger':43B 'version':26B,72C 'vulner':61C 'webform':2A,22B,24B,64C,71C 'without':36B,57C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Webform module in the affected version ranges are exposed. The sources do not say which Webform feature or request path triggers the excessive allocation, so the exact exposure surface is unknown. Sites without the Webform module, or running a version outside those ranges, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96365","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96365","severity":null,"published_at":"2026-10-22T02:17:06+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96365","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96365","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}